sparse-llvm segfaults when passing a struct pointer

sparse-llvm segfaults when passing a struct pointer

[Jonathan Neuschäfer]

Hi,

compiling a little real-world program with sparse-llvm, it segfaulted.
Using a tool called "delta"[1] and some bash scripting, I managed to
reduce the code to this test case:

    //struct foo {int a;};
    //struct foo;
    extern struct foo *foop;
    extern void func(struct foo *f);
    int main(int argc, char **argv) {
    	func(foop);
    }

(Uncommenting the commented lines doesn't change the crashing)

gdb gives me this backtrace:

    (gdb) bt
    #0  0x080b86c1 in LLVMBuildPtrToInt ()
    #1  0x080530fd in output_op_load (insn=0xb742512c, fn=0xbf85624c) at sparse-llvm.c:595
    #2  output_insn (insn=0xb742512c, fn=0xbf85624c) at sparse-llvm.c:1008
    #3  output_bb (generation=7, fn=0xbf85624c, bb=<optimized out>) at sparse-llvm.c:1096
    #4  output_fn (module=0xb7738f0c, module@entry=0x8ccc750, ep=<error reading variable: Unhandled dwarf expression opcode 0xfa>,
        ep=<error reading variable: Unhandled dwarf expression opcode 0xfa>) at sparse-llvm.c:1166
    #5  0x080507ec in compile (list=0xb773858c, module=0x8ccc750) at sparse-llvm.c:1227
    #6  main (argc=2, argv=0xbf856684) at sparse-llvm.c:1246

I'm using llvm version 3.0 (package version 1:3.0-14) from Debian and
sparse v0.4.4-100-g063236f (the most recent commit in git).

Thanks,
Jonathan Neuschäfer


[1] http://delta.tigris.org/

PS: I've also found sparse-llvm to crash if the source file contains
only the following (obviously incorrect) line, but I considered that
lower priority, since it is already incorrect code:

	static void out_byte(FILE *out, unsigned char byte) {
--
To unsubscribe from this list: send the line "unsubscribe linux-sparse" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: sparse-llvm segfaults when passing a struct pointer

[Pekka Enberg]

Hello Jonathan,

[ Please CC me on sparse-llvm related issues. ]

On Thu, Jul 19, 2012 at 4:17 PM, Jonathan Neuschäfer
<j.neuschaefer@gmx.net> wrote:
> compiling a little real-world program with sparse-llvm, it segfaulted.
> Using a tool called "delta"[1] and some bash scripting, I managed to
> reduce the code to this test case:
>
>     //struct foo {int a;};
>     //struct foo;
>     extern struct foo *foop;
>     extern void func(struct foo *f);
>     int main(int argc, char **argv) {
>         func(foop);
>     }
>
> (Uncommenting the commented lines doesn't change the crashing)
>
> gdb gives me this backtrace:
>
>     (gdb) bt
>     #0  0x080b86c1 in LLVMBuildPtrToInt ()
>     #1  0x080530fd in output_op_load (insn=0xb742512c, fn=0xbf85624c) at sparse-llvm.c:595
>     #2  output_insn (insn=0xb742512c, fn=0xbf85624c) at sparse-llvm.c:1008
>     #3  output_bb (generation=7, fn=0xbf85624c, bb=<optimized out>) at sparse-llvm.c:1096
>     #4  output_fn (module=0xb7738f0c, module@entry=0x8ccc750, ep=<error reading variable: Unhandled dwarf expression opcode 0xfa>,
>         ep=<error reading variable: Unhandled dwarf expression opcode 0xfa>) at sparse-llvm.c:1166
>     #5  0x080507ec in compile (list=0xb773858c, module=0x8ccc750) at sparse-llvm.c:1227
>     #6  main (argc=2, argv=0xbf856684) at sparse-llvm.c:1246
>
> I'm using llvm version 3.0 (package version 1:3.0-14) from Debian and
> sparse v0.4.4-100-g063236f (the most recent commit in git).

The SIGSEGV is caused by pseudo_to_value() returning NULL for "foop".
AFAICT, we should use LLVMGetNamedGlobal() to look it up but
unfortunately output_data() is *not* called for "foop" at all so the
backend doesn't know about it.

Linus, Jeff, how does the sparse frontend deal with externs? Why isn't
"foop" visible after linearize_symbol()?

                        Pekka
--
To unsubscribe from this list: send the line "unsubscribe linux-sparse" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: sparse-llvm segfaults when passing a struct pointer

[Linus Torvalds]

On Fri, Jul 20, 2012 at 1:21 AM, Pekka Enberg <penberg@kernel.org> wrote:
>
> Linus, Jeff, how does the sparse frontend deal with externs? Why isn't
> "foop" visible after linearize_symbol()?

'extern' symbols are just names with types. They don't have any value
associated with them, they just have the type and the name.

What else would you expect sparse to have?

              Linus